Admin Authentication

Authorization: Bearer <WORKOS_JWT_TOKEN>
Content-Type: application/json

// Exchange WorkOS auth code for JWT
const response = await fetch('/admin/auth/workos/callback', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    code: authCode,
    redirectUri: 'https://admin.journey.com/callback'
  })
});

const { token, user, permissions } = await response.json();

// API checks permissions automatically
// Returns 403 if insufficient permissions

const giftPoints = await fetch(
  '/admin/members/01J5XYZ.../gift',
  {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${token}` // Must have members:gift
    },
    body: JSON.stringify({ points: 1000 })
  }
);